Thank you for the suggestion and recommendation. Right now the application is broken up into decoupled modules pretty well (though it could certainly be improved).

I think I gave a pretty poor example in the question, not explaining exactly what I was confused about. Say I have an Auth module with a full suite of methods (login, logout, etc.). Supposed I had a client request a customization that not only requires a username/password for login, but also (as a contrived example) the user's employee number. I'm not sure how to setup the application architecture to (1) easily allow modification of the Users table to include an "employee_number" field (2) update the Auth module to check for employee number in the login function and (3) modify, say, the Login module to update the form that displays the username/password/employee number fields.

My ultimate goal is to work some system where the Auth module/Login module/database tables did not have to be directly changed, so software can still easily be updated.